AWS ALB Host Header Rules: Strengthening Traffic Control

In modern cloud architectures, controlling incoming traffic at the application layer is critical. Amazon Web Services Application Load Balancer (ALB) enables fine-grained routing using listener rules, including filtering based on host headers.

---

What is a Host Header Rule?

A Host header rule ensures that only requests matching specific domain names (e.g., demo.cloud.com) are allowed and routed to your backend.

This helps:

• Route traffic to the correct service

• Restrict access to only valid domains

---

How to Configure (as shown in screenshot)

1. Go to EC2 → Load Balancers → Listeners

2. Select your HTTPS:443 listener

3. Click Add rule

4. Under Conditions → Add condition → Host header

5. Enter your domain:

   • Exact: demo.example.com

   • Wildcard: *.example.com

6. Set action → Forward to target group

7. Assign priority (lower number = higher priority)

---

Important Behavior

• Rules are evaluated top-down (by priority)

• If no rule matches → Default action is triggered (commonly 403)

---

Why It Matters

• Prevents unwanted traffic hitting your backend

• Reduces exposure via ALB DNS

• Helps mitigate Host Header Injection risks

---

Key Takeaway

Use Host Header rules to allow only trusted domains and enforce a default deny (403) for everything else.